Searchable investigation history for event data store
AssigneeSumo Logic, Inc.
InventorsKenny Tidwell, David Frampton, Brendan O'Connell
Life of this patent
Estimating the term…
Abstract
A processing device receives a first query comprising a first field value and a first time period. The processing device performs a first search of a data store to identify a first plurality of events having the first time period and at least one field that comprises the first field value. The processing device generates a first search object comprising the first field value. The processing device generates a search event comprising the first field value and a reference to the first search object. An event entry for the first search event is then written to the data store. Future searches may return both the first search event and other events.
Claims20
A computer-implemented method comprising:
- performing one or more search queries for querying an event data store, the search queries being part of an investigation;
- storing, in the event data store, search object associated with each search query during the investigation, where at least one search query references a previously-executed search query that produced results to generate the at least one search query;
- creating a resolution object after reaching a resolution of the investigation, the resolution object comprising information on search objects that contributed to the resolution of the investigation;
- receiving a new search query;
- detecting that the new search query matches search values during the investigation;
- presenting, in response to the detecting, details of the investigation and the resolution of the investigation, the presenting comprising providing options to select any of the search objects from the investigation;
- detecting a selection of one of the search objects from the investigation;
- executing a new query based on the selected search object;
- and
- causing presentation of results from the new query.
A system comprising:
- a memory comprising instructions;
- and
- one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the system to perform operations comprising:
- performing one or more search queries for querying an event data store, the search queries being part of an investigation;
- storing, in the event data store, search object associated with each search query during the investigation, where at least one search query references a previously-executed search query that produced results to generate the at least one search query;
- creating a resolution object after reaching a resolution of the investigation, the resolution object comprising information on search objects that contributed to the resolution of the investigation;
- receiving a new search query;
- detecting that the new search query matches search values during the investigation;
- presenting, in response to the detecting, details of the investigation and the resolution of the investigation, the presenting comprising providing options to select any of the search objects from the investigation;
- detecting a selection of one of the search objects from the investigation;
- executing a new query based on the selected search object;
- and
- causing presentation of results from the new query.
A non-transitory machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:
- performing one or more search queries for querying an event data store, the search queries being part of an investigation;
- storing, in the event data store, search object associated with each search query during the investigation, where at least one search query references a previously-executed search query that produced results to generate the at least one search query;
- creating a resolution object after reaching a resolution of the investigation, the resolution object comprising information on search objects that contributed to the resolution of the investigation;
- receiving a new search query;
- detecting that the new search query matches search values during the investigation;
- presenting, in response to the detecting, details of the investigation and the resolution of the investigation, the presenting comprising providing options to select any of the search objects from the investigation;
- detecting a selection of one of the search objects from the investigation;
- executing a new query based on the selected search object;
- and
- causing presentation of results from the new query.
Dependencies are inferred from the claim text.